openssh: update to OpenSSH v8.7p1Some notable changes, from upstream's release notes:- sshd(8): Remove support for obsolete "host/port" syntax.- ssh(1): When prompting whether to record a new ho
openssh: update to OpenSSH v8.7p1Some notable changes, from upstream's release notes:- sshd(8): Remove support for obsolete "host/port" syntax.- ssh(1): When prompting whether to record a new host key, accept the key fingerprint as a synonym for "yes".- ssh-keygen(1): when acting as a CA and signing certificates with an RSA key, default to using the rsa-sha2-512 signature algorithm.- ssh(1), sshd(8), ssh-keygen(1): this release removes the "ssh-rsa" (RSA/SHA1) algorithm from those accepted for certificate signatures.- ssh-sk-helper(8): this is a new binary. It is used by the FIDO/U2F support to provide address-space isolation for token middleware libraries (including the internal one).- ssh(1): this release enables UpdateHostkeys by default subject to some conservative preconditions.- scp(1): this release changes the behaviour of remote to remote copies (e.g. "scp host-a:/path host-b:") to transfer through the local host by default.- scp(1): experimental support for transfers using the SFTP protocol as a replacement for the venerable SCP/RCP protocol that it has traditionally used.Additional integration work is needed to support FIDO/U2F in the basesystem.Deprecation Notice------------------OpenSSH will disable the ssh-rsa signature scheme by default in thenext release.Reviewed by: impMFC after: 1 monthRelnotes: YesSponsored by: The FreeBSD FoundationDifferential Revision: https://reviews.freebsd.org/D29985(cherry picked from commit 19261079b74319502c6ffa1249920079f0f69a72)(cherry picked from commit f448c3ed4ae1281861913a56377f9d93d49f8e8e)(cherry picked from commit 1f290c707a19d1695c303e6c8ead9cc414ccc6dc)(cherry picked from commit 0f9bafdfc325779e4ecc5154d5bb06c752297138)(cherry picked from commit adb56e58e8db84d8087ebe3d3e7def0074cb5a90)(cherry picked from commit 576b58108c1723c85e4dd00355e29bfe301dab11)(cherry picked from commit 1c99af1ebe61cbaf633792941640dcd254acf921)(cherry picked from commit 87152f34054921632016bc5eb4ab9f836fbaa522)(cherry picked from commit 172fa4aa7577915bf5ace5783251821d3774dc05)
show more ...
ssh: move common Makefile boilerplate to a new ssh.mkThis moves SSHDIR and ssh_namespace.h handling to a common location,and will simplify future work such as adding U2F support (D32509).Reviewe
ssh: move common Makefile boilerplate to a new ssh.mkThis moves SSHDIR and ssh_namespace.h handling to a common location,and will simplify future work such as adding U2F support (D32509).Reviewed by: kevansMFC after: 1 weekSponsored by: The FreeBSD FoundationDifferential Revision: https://reviews.freebsd.org/D32808(cherry picked from commit 9d63429fa16352f58037ac2aa6ddc734b25e8331)
Replace literal uses of /usr/local in C sources with _PATH_LOCALBASELiteral references to /usr/local exist in a large number of files inthe FreeBSD base system. Many are in contributed software, i
Replace literal uses of /usr/local in C sources with _PATH_LOCALBASELiteral references to /usr/local exist in a large number of files inthe FreeBSD base system. Many are in contributed software, in configurationfiles, or in the documentation, but 19 uses have been identified in Csource files or headers outside the contrib and sys/contrib directories.This commit makes it possible to set _PATH_LOCALBASE in paths.h to usea different prefix for locally installed software.In order to avoid changes to openssh source files, LOCALBASE is passed tothe build via Makefiles under src/secure. While _PATH_LOCALBASE could havebeen used here, there is precedent in the construction of the path used toa xauth program which depends on the LOCALBASE value passed on the compilercommand line to select a non-default directory.This could be changed in a later commit to make the openssh buildconsistently use _PATH_LOCALBASE. It is considered out-of-scope for thiscommit.Reviewed by: impMFC after: 1 monthDifferential Revision: https://reviews.freebsd.org/D26942
Update Makefile.depend filesUpdate a bunch of Makefile.depend files asa result of adding Makefile.depend.options filesReviewed by: bdreweryMFC after: 1 weekSponsored by: Juniper NetworksDi
Update Makefile.depend filesUpdate a bunch of Makefile.depend files asa result of adding Makefile.depend.options filesReviewed by: bdreweryMFC after: 1 weekSponsored by: Juniper NetworksDifferential Revision: https://reviews.freebsd.org/D22494
openssh: cherry-pick OpenSSL 1.1.1 compatibilityCompatibility with existing OpenSSL versions is maintained.Upstream commits:482d23bcac upstream: hold our collective noses and use the openssl-1.1
openssh: cherry-pick OpenSSL 1.1.1 compatibilityCompatibility with existing OpenSSL versions is maintained.Upstream commits:482d23bcac upstream: hold our collective noses and use the openssl-1.1.x48f54b9d12 adapt -portable to OpenSSL 1.1x API86e0a9f3d2 upstream: use only openssl-1.1.x API here tooa3fd8074e2 upstream: missed a bit of openssl-1.0.x API in this unittestcce8cbe0ed Fix openssl-1.1 fallout for --without-openssl.Trivial conflicts in sshkey.c and test_sshkey.c were resolved.Connect libressl-api-compat.c to the build, and regenerate config.hReviewed by: desApproved by: re (rgrimes)MFC after: 2 seeksSponsored by: The FreeBSD FoundationDifferential Revision: https://reviews.freebsd.org/D17444
Upgrade to OpenSSH 7.8p1.Approved by: re (kib@)
Upgrade to OpenSSH 7.7p1.
Upgrade to OpenSSH 7.6p1. This will be followed shortly by 7.7p1.This completely removes client-side support for the SSH 1 protocol,which was already disabled in 12 but is still enabled in 11. F
Upgrade to OpenSSH 7.6p1. This will be followed shortly by 7.7p1.This completely removes client-side support for the SSH 1 protocol,which was already disabled in 12 but is still enabled in 11. For thatreason, we will not be able to merge 7.6p1 or newer back to 11.
DIRDEPS_BUILD: Update dependencies.Sponsored by: Dell EMC Isilon
Fix invalid .o SRCS from r314527.MFC after: 1 weekSponsored by: Dell EMC Isilon
Upgrade to OpenSSH 7.4p1.
crypto: normalize paths using SRCTOP-relative paths or :H when possibleThis simplifies make logic/outputMFC after: 1 monthSponsored by: Dell EMC Isilon
Upgrade to OpenSSH 7.3p1.
Only bake krb5_config.h support in to ssh(3), etc if both MK_GSSAPI andMK_KERBEROS_SUPPORT != noThis fixes the odd case where someone specified MK_GSSAPI=no andMK_KERBEROS_SUPPORT=yes (which admi
Only bake krb5_config.h support in to ssh(3), etc if both MK_GSSAPI andMK_KERBEROS_SUPPORT != noThis fixes the odd case where someone specified MK_GSSAPI=no andMK_KERBEROS_SUPPORT=yes (which admittedly, probably doesn't make sense,but the build system doesn't prevent this case today, and it didn't whenI filed the bug back in 2011 either).MFC after: 2 weeksPR: 159745
Upgrade to OpenSSH 7.2p2.
DIRDEPS_BUILD: Update dependencies.Sponsored by: EMC / Isilon Storage Division
Upgrade to OpenSSH 7.0p1.
List source files (foo.c) instead of object files in SRCS.Reviewed by: bdrewery
Upgrade to OpenSSH 6.8p1.
Upgrade to OpenSSH 6.7p1, retaining libwrap support (which has been removedupstream) and a number of security fixes which we had already backported.MFC after: 1 week
Replace unneeded manual dependency on header by adding it to SRCS.bsd.lib.mk and bsd.prog.mk already depend all objs on headers in SRCS ifthere is not yet a depend file. The headers in SRCS are n
Replace unneeded manual dependency on header by adding it to SRCS.bsd.lib.mk and bsd.prog.mk already depend all objs on headers in SRCS ifthere is not yet a depend file. The headers in SRCS are never built orinstalled. After 'make depend' the header was already added as a properdependency on the objects where needed.MFC after: 2 weeksSponsored by: EMC / Isilon Storage Division
META MODE: Prefer INSTALL=tools/install.sh to lessen the need for xinstall.host.This both avoids some dependencies on xinstall.host and allowsbootstrapping on older releases to work due to lack of
META MODE: Prefer INSTALL=tools/install.sh to lessen the need for xinstall.host.This both avoids some dependencies on xinstall.host and allowsbootstrapping on older releases to work due to lack of at least 'install -l'support.Sponsored by: EMC / Isilon Storage Division
Retire the NONE cipher option.
new depends
Fix typo when deregistering the VLAN unconfig event handlerSubmitted by: Masao Uebayashi <[email protected]>MFC after: 3 days
1234